Privacy

What we collect

• Your account details: email address and, if you sign in with Google, your Google account ID, name and photo.
• Everything you add to your page: profile, links, products, bookings and settings.
• Aggregate visit and click counts for your page, used for your analytics. Individual events are kept for 13 months, then only daily totals remain.

Analytics without cookies

Visits and clicks are counted on our servers. Unique visitors are estimated with an anonymised identifier that rotates daily, so visitors can't be followed across days or across sites. Approximate location (country, region and city) is worked out from the IP address at the moment of the visit; the address itself isn't stored. We don't set tracking cookies on public pages.

Polls and Q&A use a separate anonymised identifier made from the same details. For polls it's tied to that one poll, so a visitor votes once; for Q&A it limits how fast questions can be sent. Unlike the visit identifier it doesn't rotate daily.

Who processes data for us

We use a small number of service providers to run BuzzKit. Each receives only what it needs for its job:

• DigitalOcean: hosts our servers, database and cache, so it stores your account and page data.
• Cloudflare: serves the website and passes requests to our servers, so it sees visitors' IP addresses and request details. Cloudflare R2 stores the images you upload.
• Resend: sends our emails, such as sign-in codes and subscriber confirmations, so it receives the recipient's email address and the message.
• Google: shows ads (see Ads below) and, if you choose it, signs you in.

Providers act on our instructions, or for Google ads as their own controller. Some are based outside your country, so your data may be transferred internationally with safeguards such as standard contractual clauses. The full list is in our data processing terms.

Server logs

Like most websites, our web server keeps a short-lived access log for security and troubleshooting: the IP address, time, page requested, response status and browser user agent. Query strings aren't logged. These logs aren't used for analytics or ads, and they're rotated out automatically.

Cookies

We only set cookies that are strictly necessary: keeping you signed in to your dashboard and remembering your cookie choices. Public pages can embed third-party tools such as a creator's scheduler (for example Calendly), which may set their own cookies. Those load only after you allow third-party embeds; otherwise they open in a new tab. Change your choice anytime from Cookie preferences at the bottom of any BuzzKit page. Google uses cookies for ads only after you allow them (see Ads below). A page owner can also add their own Meta, TikTok or Google Analytics pixels. Those load only after you allow them in Cookie preferences, and the owner, not BuzzKit, is responsible for what they collect.

Images from other sites

Page owners can use pictures hosted on other sites, such as a link thumbnail, a product cover, or an item from a feed they add. Your browser loads those pictures straight from the site that hosts them, so that site can see your IP address and browser details, just as it would if you visited it. BuzzKit does not send them anything else, and these requests do not set cookies through BuzzKit.

Ads

Ads on eligible public pages are clearly labelled. Sponsored cards are chosen by BuzzKit, and advertisers don't receive your visitors' personal data. When a visitor clicks a sponsored card, the sponsor's address gets a utm_content tag with the username of the page it was clicked on, so sponsors can see which pages sent traffic. It never includes a visitor's name, email or IP address.

Public pages can show ads served by Google (through Google Publisher Tag). Nothing loads from Google until you make a choice in the prompt or in Cookie preferences, and you can change it anytime. In the EU, EEA, UK and Switzerland, and wherever we can't tell your country, we load no Google ad, and nothing from Google, unless you allow ad cookies; if you decline, you see no Google ad. In other regions, declining still shows Google's limited ads, which don't use cookies or personalisation, though Google still receives your IP address to deliver them. Your country comes from a header our hosting network adds to the request, or a lookup of your IP address that isn't stored. If you allow cookies, Google may use cookies or similar identifiers to serve and measure ads, and may personalise them, in line with Google's advertising policies. Visitors can manage ad personalisation in Google Ad Settings. BuzzKit does not share any account data with Google for ads.

Sponsor requests

If you ask to sponsor BuzzKit, we keep your name, work email, company, website, budget and message so we can reply. To stop abuse of the form we also keep a scrambled, daily-changing fingerprint of your network address, not the address itself. We email you once to confirm the request. Requests that aren't confirmed are deleted after a day, and declined or spam requests after 90 days.

Your controls

Export your data (one full JSON file, or a spreadsheet of links, products and subscribers) or delete your account from Dashboard, Account settings. Deleting your account takes your page offline immediately and permanently removes your data. Abuse reports about a deleted page are kept, without the page's content, so our safety team can still act on repeat abuse; administrator audit records are also kept.

How long we keep data

• Account and page data: until you delete your account, which removes it immediately.
• Visit and click events: 13 months, then only daily totals.
• Activity history, the record of who changed what on a page, with the old and new value of each change: 13 months. It is shown to the page's owner and admins, and your own entries are in your data export. When you delete your account, your entries stay in the page history without your name.
• Sign-in codes and sessions: until they expire or you sign out.
• Server logs: rotated out automatically after a short period.
• Unconfirmed sponsor requests: one day. Declined or spam requests: 90 days.
• Anything the law requires us to keep, such as abuse reports and administrator audit records, for as long as it requires.

Legal bases

If you are in the EEA, UK or Switzerland we process data to perform our contract with you (running your account and page), for our legitimate interests (security, abuse prevention, approximate analytics, showing ads where no consent is needed), with your consent (cookies, third-party embeds, Google ad personalisation, marketing emails) and to meet legal obligations. You can withdraw consent anytime.

Your rights

You can access, correct, export and delete your data, object to or restrict how we use it, and withdraw consent. Most of this is self-service in Dashboard, Account settings. For anything else, or to appeal a decision, email us. We may ask you to confirm it is you, and we answer within one month. We honour the Global Privacy Control signal as an opt-out of ad personalisation, and we do not sell personal data. If you are unhappy with our answer, you can complain to your local data protection authority.

If a creator collects your email or message through their page, they are responsible for that data and we only process it for them: contact the creator first, or email us and we will pass your request on.

Children

BuzzKit is not for children under 16 (or the higher age your country sets for consent). We do not knowingly collect their data. If you think a child has an account or has sent data through a page, email us and we will delete it.

Security and transfers

Connections are encrypted, sign-in tokens are kept in HttpOnly cookies, and codes and tokens are stored hashed. Our providers may process data outside your country; where they do, we rely on safeguards such as standard contractual clauses.

Changes and contact

If we change this policy in a way that matters, we will tell account owners by email and in the dashboard before it takes effect. Questions or requests: support@buzzkit.app. We are BuzzKit, and we are the controller of your account data.